CN103077331B - A digital resource protection method and related device - Google Patents

Abstract

The embodiment of the invention discloses a digital resource protection method and a related device, wherein a digital resource protection device comprises: a configuration module for configuring N secret index values corresponding to digital resources to be encrypted, wherein N is greater than 0; and the digital logic control module is used for taking any one or more of the N secret index values and the digital resources as input parameters of a preset digital logic circuit and carrying out logic encryption on the digital resources through the preset digital logic circuit. The technical scheme provided by the embodiment of the invention can effectively improve the safety of digital resource protection.

Description

A digital resource protection method and related device

technical field

The present invention relates to the field of digital resources, in particular to a digital resource protection method and a related device.

Background technique

Digital resources include cultural content products and services that are generated, produced, managed, disseminated, operated, and consumed with digital technologies, such as digital media, computer software, electronic services, and equipment use rights protection clauses, etc.

Currently, digital resources are protected and authorized using a content digital rights encryption protection (DRM, Digital Rights Management) system. The working principle of DRM technology is to first establish a digital resource authorization center, and the coded and compressed digital resources can be encrypted and protected with a key, and the encrypted digital resource head stores the key identifier and the uniform resource locator of the digital resource authorization center ( URL, UniversalResourceLocator) information. When ordering, the user will verify and authorize with the digital resource authorization center according to the key identification and URL information in the header of the digital resource. After the verification and authorization pass, the user can decrypt the digital resource on demand through the key sent by the digital resource authorization center. and play the digital resource.

Since the DRM system uses a key to encrypt digital resources and issue them, when the decrypted key is sent to the user, once the key is obtained by a hacker, the media file can be easily decrypted. It can be seen that the digital resources are currently protected through the DRM system. There are certain security risks in the protection, which can easily lead to problems such as theft of media files and loss of copyright.

Contents of the invention

The embodiment of the present invention provides a digital resource protection method and a related device, which are used to improve the security of digital resource protection.

In order to solve the above technical problems, embodiments of the present invention provide the following technical solutions:

A digital resource protection device, comprising:

A configuration module for configuring N secret protection index values corresponding to digital resources that need to be encrypted, wherein the above-mentioned N is greater than 0;

The number used to logically encrypt the above-mentioned digital resources through the above-mentioned preset digital logic circuit using any one or more of the above-mentioned N secret protection index values and the above-mentioned digital resources as input parameters of the preset digital logic circuit Logic control module.

A device for using digital resources, comprising:

The obtaining module is used to obtain the authorization information of the registered user, wherein the above authorization information is generated by binding the user characteristic information of the above registered user with one of the N secret protection index values by the digital resource protection device, and the above The digital resource protection device uses any one or more of the above-mentioned N secret protection index values and digital resources as input parameters of a preset digital logic circuit, and logically encrypts the above-mentioned digital resources through the preset digital logic circuit;

The first feature collection module is used to collect the user feature information input by the registered user;

The first decryption module is used to obtain the secret security index value bound to the above-mentioned registered user according to the user characteristic information input by the above-mentioned registered user collected by the above-mentioned first characteristic collection module and the authorization information obtained by the above-mentioned acquisition module;

The second decryption module is configured to use the secret index value obtained by the first decryption module and the encrypted data of the digital resource as input parameters of the digital logic circuit, and logically decrypt the encrypted data through the digital logic circuit to obtain digital resources above.

A digital resource protection method, comprising:

Configure N secret protection index values corresponding to the digital resources that need to be encrypted, wherein the above N is greater than 0;

Using any one or more of the above-mentioned N security index values and the above-mentioned digital resources as input parameters of a preset digital logic circuit, logically encrypt the above-mentioned digital resources through the above-mentioned preset digital logic circuit.

A digital resource protection method, comprising:

Obtain the authorization information of the registered user, wherein the above authorization information is generated by binding the user characteristic information of the above registered user with one of the N secret security index values by the digital resource protection device, and the above digital resource protection device will Any one or more of the above-mentioned N secret protection index values, and the digital resources are used as input parameters of the preset digital logic circuit, and the above-mentioned digital resources are logically encrypted through the preset digital logic circuit;

Collect the user characteristic information input by the above-mentioned registered users;

Obtain the secret security index value bound to the above-mentioned registered user according to the above-mentioned collected user characteristic information input by the above-mentioned registered user and the above-mentioned authorization information;

The secret index value bound to the registered user and the encrypted data of the digital resource are used as input parameters of the digital logic circuit, and the encrypted data is logically decrypted by the digital logic circuit to obtain the digital resource.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the digital resource is logically encrypted through the preset digital logic circuit. When the input parameters of the logic circuit are the same, the results obtained after encrypting the same data are also different. Therefore, even if the hacker obtains the secret security index value corresponding to the above-mentioned digital resource through deciphering means, it is difficult to obtain the encrypted digital resource. The preset digital logic circuit used cannot decode and use the above-mentioned digital resources, which greatly improves the security of digital resource protection.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a schematic structural diagram of an embodiment of a digital resource protection device provided by the present invention;

Fig. 2 is a schematic structural diagram of another embodiment of a digital resource protection device provided by the present invention;

FIG. 3 is a schematic flowchart of an embodiment of a digital resource protection method provided by the present invention;

FIG. 4 is a schematic flowchart of another embodiment of a digital resource protection method provided by the present invention;

Fig. 5 is a schematic flowchart of an embodiment of a device for using digital resources provided by the present invention;

FIG. 6 is a schematic flowchart of another embodiment of a digital resource protection method provided by the present invention.

detailed description

The embodiment of the present invention provides a digital resource protection method and a related device.

In order to make the purpose, features and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described The embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

A digital resource protection device in the embodiment of the present invention is described below, please refer to FIG. 1 , the digital resource protection device 100 in the embodiment of the present invention includes:

A configuration module 101 for configuring N secret index values corresponding to digital resources that need to be encrypted, wherein the above-mentioned N is greater than 0.

A digital logic control module 102 configured to use any one or more of the above-mentioned N secret index values and the above-mentioned digital resources as input parameters of the digital logic circuit, and perform logical encryption on the above-mentioned digital resources through the above-mentioned digital logic circuit.

In the embodiment of the present invention, the configuration module 101 can determine the value of N according to the circulation of the above-mentioned digital resources, and N can be equal to the circulation of the above-mentioned digital resources, or N can also be greater than the circulation of the above-mentioned digital resources, which is not limited here .

In one implementation, the digital logic control module 102 includes a digital logic circuit, and the digital logic control module 102 uses any one of the N security index values configured by the configuration module 101 and the above-mentioned digital resources as the key of the above-mentioned digital logic circuit. The input parameters are used to logically encrypt the above-mentioned digital resources through the above-mentioned digital logic circuit, and the obtained encrypted data may be different according to the input secret security index value.

In another implementation, the digital logic control module 102 includes a digital logic circuit, and the digital logic control module 102 can use a set of security index values and the above-mentioned digital resources as the input parameters of the above-mentioned digital logic circuit, through the above-mentioned digital logic The circuit performs logical encryption on the above-mentioned digital resources, and the obtained encrypted data is the same for each secret index value in the secret index value set. This has the advantage that in the authorized distribution and transfer of digital resources, there is only one encrypted data, and it is the same for all authorized users, which is convenient for control and improves efficiency. Wherein, the aforementioned set of secret security index values includes M secret security index values among the N secret security index values configured by the configuration module 101, wherein M is greater than 1 and less than or equal to N.

It should be noted that the digital resources in the embodiments of the present invention can be digital media (such as text, graphics, images, audio and video and other digital types or a combination of multiple types), computer software, electronic services, equipment used Rights protection terms, etc., are not limited here.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the preset digital logic circuit (such as the digital logic circuit set by the copyright issuer) Logically encrypt the digital resources, because different digital logic circuits can obtain different results after encrypting the same data under the same input parameters. Therefore, even if hackers obtain the secret protection corresponding to the above digital resources The index value, because it is difficult to obtain the preset digital logic circuit used to encrypt the digital resource, makes it impossible to decode and use the above digital resource, which greatly improves the security of digital resource protection.

In another embodiment of the present invention, the digital resource protection device 100 can further provide an authorization mechanism for encrypted digital resources, so as to be applied in the issuance of digital resources. In the embodiment of the present invention, N secret security index values can be bound with N specific users in advance, and the digital logic control module 102 can combine a subset G of the N secret security index values configured by the configuration module 101 with the above-mentioned numbers The resource is used as the input parameter of the digital logic circuit above, and the above digital resource is logically encrypted through the above digital logic circuit, and the encrypted data obtained is only authorized to decrypt the data by those users bound to the elements in the secret security index value subset G , other clients cannot decrypt the data. For example: for a legal user, when he pays for the purchase or obtains the right to use a certain digital resource through other legal channels, the user's user characteristic information can be associated with the encrypted digital resource with relevant rights. Corresponds to a secret security index value of . That is to say, only the user who uses his own user characteristic information to open his secret protection channel can correctly decrypt the encrypted digital resources. The user's secret protection channel is at the level of hardware logic circuit (such as binding with a specific digital logic circuit), which can greatly improve the protection and security of the use of digital resources.

As shown in FIG. 2, on the basis of the digital resource protection device 100 shown in FIG. 1, the digital resource protection device 200 further includes:

Feature collection module 103, for collecting user feature information of registered users;

For the convenience of understanding and description, in the embodiment of the present invention, the user who obtains the authority to use the digital resource is called a registered user, and the user feature information of the registered user is firstly collected by the feature collection module 103 . The user characteristic information includes any one of the following information or a combination of any two or more pieces of information: terminal identification, specified gesture information, user biometric information, and user input characters. Among them, the above-mentioned terminal identification is used to indicate the terminal used by the registered user to use the above-mentioned digital resources in the future (for the convenience of description, the terminal used by the registered user to use the above-mentioned digital resources in the future is referred to as an authorized terminal); the specified gesture information The acquisition of the authorized terminal requires that the authorized terminal has a touch function, and the registered user can use the touch function of the authorized terminal to input a specified gesture, so that the feature collection module 103 can collect the specified gesture information; Features can be, for example, human face, pupils, or fingerprints.

The authorization module 104 is used to bind the user characteristic information of the above-mentioned registered user obtained by the feature collection module 103 with one of the above-mentioned N secret protection index values, so as to generate the authorization information of the above-mentioned registered user, the authorization information Contains the binding relationship information between the user characteristic information of the registered user and a secret security index value.

In the embodiment of the present invention, for the convenience of management, a secret security index value is assigned to only one registered user, and then the authorization module selects an unassigned secret security index value from the above N secret security index values, and the secret security index The value is bound with the user characteristic information of the above-mentioned registered user, that is, the authorization information of the above-mentioned registered user is generated. In an implementation manner, the generated authorization information of the registered user is specifically the value obtained by XORing the user characteristic information and the secret security index value, that is, Among them, F refers to user characteristic information, and Aindex1 refers to a secret security index value. Of course, the authorization module 104 can also bind the secret security index value with the above-mentioned user characteristic information of the registered user in other ways, which is not limited here. Of course, in some scenarios, a secret security index value can also be assigned to multiple registered users, which is not limited here.

The sending module 105 is configured to send the authorization information of the above-mentioned registered user to the above-mentioned registered user, so that the above-mentioned registered user obtains the secret security index value bound to the above-mentioned user by inputting the user characteristic information and combining the authorization information of the above-mentioned registered user. The secret security index value and the decryption of the above-mentioned digital logic circuit use the above-mentioned digital resources.

In the embodiment of the present invention, when the registered user obtains the authorization information from the sending module 105, because the authorization information includes the binding relationship information between the registered user characteristic information and a secret security index value, the registered user needs to re-enter the above-mentioned User characteristic information consistent with user characteristic information, so that the registration terminal obtains the secret security index value of the above-mentioned registered user according to the user characteristic information input again by the user and the above-mentioned authorization information, uses the secret security index value, and uses the same as the digital logic control module 102 The digital logic circuit decrypts the aforementioned digital resources. For example, assuming that the above authorization information is the XOR value of the user characteristic information F and the secret security index value Aindex1, that is F=0111001, Aindex1=1010001, then the value of authorization information At this time, if the user characteristic information input by the user is F again, then XOR the user characteristic information F and U1 input by the user to obtain Aindex1, as In practical applications, since the user feature information collected by the registration terminal may not be exactly the same each time, for example, for user-specified gestures and user biometric information, a slight change in the sampling point will change the final collected user feature information. For example, when the user obtains the authorization information, the user characteristic information re-input may be F'. Therefore, the implementation of the present invention also provides an error-tolerant error correction mechanism, by setting an error correction code (ECC, ErrorCorrectionCode), so that the user characteristic information The value of one piece of information or the value of a combination of multiple pieces of information is regarded as the same value within a predetermined range of variation, that is, when the user characteristic information input by a registered user is within a certain range of adaptation, they are all considered to be the same user characteristic information. For example, assuming that the error correction code ECC is set, you can make If the user characteristic information F' input by the registered user is within the above-mentioned adaptation range, then by F can be obtained. If the user characteristic information F' input by the registered user is not within the above adaptation range, then by Can't get an F.

Further, the embodiment of the present invention also provides a subdivision control mechanism:

In an implementation manner, there is at least one first secret index value configured with a first response vector value among the above N secret index values, and the first response vector value is used to control and communicate with the first secret index value. The number of times the registered user bound to the value uses the above digital resources. The value of the above-mentioned first response vector changes as the number of times the registered user uses the above-mentioned digital resource increases, so that when the number of times the registered user uses the above-mentioned digital resource reaches the preset threshold value, the current first response vector value just makes the first secret The security index value is invalidated or the binding between the first secret security index value and the user characteristic information of the registered user is invalidated. For example, assuming that when the value of the first response vector is set to 0, the first secret index value becomes invalid or the binding between the first secret index value and the user characteristic information of the registered user becomes invalid, then if the digital resource protection device 100 only allows If the registered user uses the digital resource 50 times, the value of the first response vector can be set to 50, and when the registered user uses the digital resource once, the value of the first response vector will be reduced by one.

In another implementation, there is at least one second secret index value configured with a second response vector value among the N secret index values, and the second response vector value is used to limit the The time period during which the registered user bound to the value uses the above digital resources. The above-mentioned second response vector value changes with time, or the above-mentioned second response vector value can remain unchanged when the current time falls within the specified time period, and only change so that the first The secret security index value is invalid or the value that invalidates the binding between the first secret security index value and the user characteristic information of the registered user. For example, assuming that when the value of the first response vector is set to 0, the first secret index value becomes invalid or the binding between the first secret index value and the user characteristic information of the registered user becomes invalid, then if the digital resource protection device 100 only allows If the registered user uses the above-mentioned digital resources within the T time period, the above-mentioned second response vector value can be set to T. When the current time is within the T time period, the second response vector value is a value other than 0. When within the T period, the value of the second response vector is changed to 0.

In yet another implementation, there is at least one third secret index value configured with a third response vector value among the N secret index values, and the third response vector value is used to limit the relationship with the third secret index value. The electronic equipment that the value-bound registered user should use when using the above-mentioned digital resources (such as the type of electronic equipment, electronic equipment model, or a specific electronic equipment that should be used when restricting the use of the above-mentioned digital resources).

In yet another implementation, there is at least one fourth secret index value configured with a fourth response vector value among the N secret index values, and the fourth response vector value is used to limit the The physical location where the registered user bound by the value should be when using the above digital resources.

Of course, in the embodiment of the present invention, other response vector values may also be configured on the secret security index value to control other rights of registered users to use the above-mentioned digital resources, which is not limited here.

Further, considering the circulation of the above-mentioned digital resources, the user groups who own and use the above-mentioned digital resources may find changes, such as the transfer of the digital resources purchased by registered users to other users, or the number of times the digital resources purchased by registered users are used Or the expiration of the use period, etc., in the above cases, the registered user will be invalidated. Therefore, the digital protection device 100 also includes:

The logout module is used to log out the authorized registered user, so that the authorized registered user cannot decrypt the above-mentioned digital resources. Specifically, the registration module may, but is not limited to, cancel the registered user in the following ways: invalidate the secret security index value bound to the registered user, or cancel the user characteristic information of the registered user and the bound secret security index value binding between.

For example, for two users F1 and F2 in the secondary market, the F1 user originally has the use authority, but the F2 does not have the use authority. If F1 transfers the purchased digital resources to F2 for use, the logout module cancels the user characteristic information of F1 Binding with the bound secret security index value. The feature collection module 103 acquires the user feature information of F2, the authorization module 104 binds the secret security index value bound before F1 with the user feature information of F2 and generates the authorization information of F2, and the authorization information of F2 is sent by the sending module 105 To F2, thus completing the exchange of usage rights between F1 and F2, after that, F1 can no longer use the exchanged digital resources, and F2 inherits F1's original usage rights to the digital resources.

The embodiment of the present invention also provides a digital resource protection method. The following describes a digital resource protection method in the embodiment of the present invention with the digital resource protection device as the subject of description. Please refer to FIG. 3 , including:

301. Configure N secret protection index values corresponding to the digital resources that need to be encrypted, wherein the above N is greater than 0;

In the embodiment of the present invention, the value of the above-mentioned N can be determined according to the circulation of the above-mentioned digital resources. For example, N can be equal to the circulation of the above-mentioned digital resources. Of course, N can also be greater than the circulation of the above-mentioned digital resources, which is not limited here. .

302. Using any one or more of the above-mentioned N secret protection index values and the above-mentioned digital resources as input parameters of the digital logic circuit, perform logical encryption on the above-mentioned digital resources through the above-mentioned digital logic circuit;

In one implementation, the digital resource protection device includes a digital logic circuit, and the digital resource protection device uses any one of the above N secret protection index values and the above digital resource as input parameters of the above digital logic circuit, through the above digital The logic circuit performs logical encryption on the above-mentioned digital resources, and the obtained encrypted data may be different according to the input security index value.

In another implementation, the digital logic control module includes a digital logic circuit, and the digital logic control module can use a set of secret index values and the above-mentioned digital resources as input parameters of the above-mentioned digital logic circuit, through the above-mentioned digital logic circuit. When the above digital resources are logically encrypted, the obtained encrypted data is the same for each secret index value in the secret index value set. This has the advantage that in the authorized distribution and delivery of digital resources, there is only one encrypted data, and it is the same for all authorized users, so it is easy to control and improve efficiency. Wherein, the above secret index value set includes M secret index values among N secret index values, wherein M is greater than 1 and less than or equal to N.

It should be noted that the digital resources in the embodiments of the present invention can be digital media (such as text, graphics, images, audio and video and other digital types or a combination of multiple types), computer software, electronic services, equipment used Rights protection terms, etc., are not limited here.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the preset digital logic circuit (such as the digital logic circuit set by the copyright issuer) Logically encrypt the digital resources, because different digital logic circuits can obtain different results after encrypting the same data under the same input parameters. Therefore, even if hackers obtain the secret protection corresponding to the above digital resources The index value, because it is difficult to obtain the preset digital logic circuit used to encrypt the digital resource, makes it impossible to decode and use the above digital resource, which greatly improves the security of digital resource protection.

Another embodiment of the present invention also provides an authorization mechanism for encrypted digital resources, which can be applied in the distribution of digital resources. In the embodiment of the present invention, the N secret security index values can be bundled with N specific users in advance, and the digital logic control module can use a subset G of the configured N secret security index values and the above-mentioned digital resources as the above-mentioned digital resources. The input parameters of the logic circuit are logically encrypted on the above-mentioned digital resources through the above-mentioned digital logic circuit, and the obtained encrypted data is only authorized to decrypt the data by users bound to the elements in the secret security index value subset G, and the rest of the customers are Unable to decrypt data. For example: for a legal user, when he pays for the purchase or obtains the right to use a certain digital resource through other legal channels, the user's user characteristic information can be associated with the encrypted digital resource with relevant rights. Corresponds to a secret security index value of . That is to say, only the user who uses his own user characteristic information to open his secret protection channel can correctly decrypt the encrypted digital resources. The user's secret protection channel is at the level of hardware logic circuit (such as binding with a specific digital logic circuit), which can greatly improve the protection and security of the use of digital resources. For ease of understanding and description, users who are qualified to use the digital resources are referred to as registered users below. Please refer to FIG. 4. Another embodiment of the digital resource protection method in the embodiment of the present invention includes:

Steps 401 to 402 are similar to steps 301 to 302 in the example shown in FIG. 3 , and reference may be made to the specific implementation in steps 301 to 302 , which will not be repeated here.

403. Collect user characteristic information of registered users;

Firstly, the digital resource protection device collects the user characteristic information of the registered user. The user characteristic information includes any one of the following information or a combination of any two or more pieces of information: terminal identification, specified gesture information, user biometric information, and user input characters. Among them, the above-mentioned terminal identification is used to indicate the terminal used by the registered user to use the above-mentioned digital resources in the future (for the convenience of description, the terminal used by the registered user to use the above-mentioned digital resources in the future is referred to as an authorized terminal); the specified gesture information The collection of the authorized terminal requires the tactile function of the authorized terminal, and the registered user can use the tactile function of the authorized terminal to input the specified gesture so that the digital resource protection device can collect the specified gesture information; Features can be, for example, human face, pupils, or fingerprints.

404. Bind the user characteristic information of the above-mentioned registered user with one of the above-mentioned N secret protection index values to generate the authorization information of the above-mentioned registered user;

In the embodiment of the present invention, for the convenience of management, a secret security index value is assigned to only one registered user, and then the authorization module selects an unassigned secret security index value from the above N secret security index values, and the secret security index The value is bound with the user characteristic information of the above-mentioned registered user, that is, the authorization information of the above-mentioned registered user is generated. In an implementation manner, the generated authorization information of the registered user is specifically the value obtained by XORing the user characteristic information and the secret security index value, that is, Among them, F refers to user characteristic information, and Aindex1 refers to a secret security index value. Of course, the digital resource protection device can also bind the secret protection index value with the user characteristic information of the registered user in other ways, which is not limited here. Of course, in some scenarios, a secret security index value can also be assigned to multiple registered users, which is not limited here.

405. Send the authorization information of the above-mentioned registered user to the above-mentioned registered user, so that the above-mentioned registered user can obtain the secret security index value bound to the above-mentioned registered user according to the above-mentioned authorized information of the above-mentioned registered user and the user characteristic information input by the above-mentioned registered user, and use this The secret security index value and the above digital logic circuit decrypt the above digital resource.

In the embodiment of the present invention, when the registered user obtains the authorization information from the digital resource protection device, since the authorization information includes the binding relationship information between the registered user characteristic information and a secret security index value, the registered user needs to input the User characteristic information consistent with the above user characteristic information, so that the registration terminal obtains the secret security index value of the above registered user according to the user characteristic information input again by the user and the above authorization information, uses the secret security index value, and uses the digital logic control module 102 The same digital logic circuit decrypts the aforementioned digital resources. The above examples illustrate, assuming that the above authorization information is the XOR value of the user characteristic information F and the secret security index value Aindex1, that is F=0111001, Aindex1=1010001, then the value of authorization information At this time, if the user characteristic information input by the user is F again, then XOR the user characteristic information F and U1 input by the user to obtain Aindex1, as In practical applications, since the user feature information collected by the registration terminal may not be exactly the same each time, for example, for user-specified gestures and user biometric information, a slight change in the sampling point will change the final collected user feature information. For example, when the user obtains the authorization information, the user characteristic information re-input may be F'. Therefore, the implementation of the present invention also provides an error-tolerant error correction mechanism. By setting the ECC, the value of an item of information in the user characteristic information Or the values of multiple information combinations are considered to be the same within a predetermined variation range, that is, when the user characteristic information input by the registered user is within a certain adaptable range, they are all considered to be the same user characteristic information. For example, assuming that the error correction code ECC is set, you can make If the user characteristic information F' input by the registered user is within the above-mentioned adaptation range, then by F can be obtained. If the user characteristic information F' input by the registered user is not within the above adaptation range, then by Can't get an F.

Further, the embodiment of the present invention also provides a subdivision control mechanism:

In an implementation manner, there is at least one first secret index value configured with a first response vector value among the above N secret index values, and the first response vector value is used to control and communicate with the first secret index value. The number of times the registered user bound to the value uses the above digital resources. The value of the above-mentioned first response vector changes as the number of times the registered user uses the above-mentioned digital resource increases, so that when the number of times the registered user uses the above-mentioned digital resource reaches the preset threshold value, the current first response vector value just makes the first secret The security index value is invalidated or the binding between the first secret security index value and the user characteristic information of the registered user is invalidated. For example, assuming that when the value of the first response vector is set to 0, the first secret index value becomes invalid or the binding between the first secret index value and the user characteristic information of the registered user becomes invalid, then if the digital resource protection device 100 only allows If the registered user uses the digital resource 50 times, the value of the first response vector can be set to 50, and when the registered user uses the digital resource once, the value of the first response vector will be reduced by one.

In another implementation, there is at least one second secret index value configured with a second response vector value among the N secret index values, and the second response vector value is used to limit the The time period during which the registered user bound to the value uses the above digital resources. The above-mentioned second response vector value changes with time, or the above-mentioned second response vector value can remain unchanged when the current time falls within the specified time period, and only change so that the first The secret security index value is invalid or the value that invalidates the binding between the first secret security index value and the user characteristic information of the registered user. For example, assuming that when the value of the first response vector is set to 0, the first secret index value becomes invalid or the binding between the first secret index value and the user characteristic information of the registered user becomes invalid, then if the digital resource protection device 100 only allows If the registered user uses the above-mentioned digital resources within the T time period, the above-mentioned second response vector value can be set to T. When the current time is within the T time period, the second response vector value is a value other than 0. When within the T period, the value of the second response vector is changed to 0.

In yet another implementation, there is at least one third secret index value configured with a third response vector value among the N secret index values, and the third response vector value is used to limit the relationship with the third secret index value. The electronic equipment that the value-bound registered user should use when using the above-mentioned digital resources (such as the type of electronic equipment, electronic equipment model, or a specific electronic equipment that should be used when restricting the use of the above-mentioned digital resources).

In yet another implementation, there is at least one fourth secret index value configured with a fourth response vector value among the N secret index values, and the fourth response vector value is used to limit the The physical location where the registered user bound by the value should be when using the above digital resources.

Of course, in the embodiment of the present invention, other response vector values may also be configured on the secret security index value to control other rights of registered users to use the above-mentioned digital resources, which is not limited here.

Further, considering the circulation of the above-mentioned digital resources, the user groups who own and use the above-mentioned digital resources may find changes, such as the transfer of the digital resources purchased by registered users to other users, or the number of times the digital resources purchased by registered users are used Or the expiration of the use period, etc., in the above cases, the registered user will be invalidated. Therefore, the digital resource protection method in the embodiment of the present invention further includes: canceling the authorized registered user, so that the authorized registered user cannot decrypt the above digital resource. Specifically, the digital resource protection device may, but is not limited to, cancel the registered user in the following manner: invalidate the secret security index value bound to the registered user, or release the user characteristic information of the registered user and the bound secret security index value. Bindings between indexed values.

For example, for two users F1 and F2 in the secondary market, the F1 user originally has the use authority, but the F2 does not have the use authority. If F1 transfers the purchased digital resources to F2 for use, the logout module cancels the user characteristic information of F1 Binding with the bound secret security index value. The feature collection module 103 acquires the user feature information of F2, the authorization module 104 binds the secret security index value bound before F1 with the user feature information of F2 and generates the authorization information of F2, and the authorization information of F2 is sent by the sending module 105 To F2, thus completing the exchange of usage rights between F1 and F2, after that, F1 can no longer use the exchanged digital resources, and F2 inherits F1's original usage rights to the digital resources.

It should be noted that the digital resources in the embodiments of the present invention can be digital media (such as text, graphics, images, audio and video and other digital types or a combination of multiple types), computer software, electronic services, equipment used Rights protection terms, etc., are not limited here.

It should be noted that the digital resource protection method in the embodiment of the present invention can be applied to the digital resource protection device in the above-mentioned device embodiment, and can be used to realize all the technical solutions in the above-mentioned device embodiment. The functions of each functional module can be specifically realized by referring to the method in this method embodiment, and the specific implementation process can refer to the relevant description in this method embodiment, and will not be repeated here.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the preset digital logic circuit (such as the digital logic circuit set by the copyright issuer) Logically encrypt the digital resources, because different digital logic circuits can obtain different results after encrypting the same data under the same input parameters. Therefore, even if hackers obtain the secret protection corresponding to the above digital resources The index value, because it is difficult to obtain the preset digital logic circuit used to encrypt the digital resource, makes it impossible to decode and use the above digital resource, which greatly improves the security of digital resource protection.

The embodiment of the present invention also provides a device for using digital resources. As shown in FIG. 5, the device 500 for using digital resources in the embodiment of the present invention includes:

The obtaining module 501 is used to obtain the authorization information of the registered user, wherein the authorization information is generated by binding the user characteristic information of the registered user with one of the N secret protection index values by the digital resource protection device;

In the embodiment of the present invention, the above-mentioned digital resource protection device uses any one or more of the above-mentioned N secret protection index values and digital resources as the input parameters of the preset digital logic circuit, and uses the preset digital logic circuit to control the above-mentioned Digital resources are logically encrypted, wherein the above N is greater than 0. After the registered user obtains the authorization of the digital resource protection device, the digital resource protection device sends the generated authorization information of the registered user to the registered user, so that the obtaining module 501 obtains the authorization information of the registered user.

The first feature collection module 502 is configured to collect the user feature information input by the above-mentioned registered user;

The user characteristic information in the embodiment of the present invention includes any one or a combination of any two or more of the following information: terminal identification, designated gesture information, user biometric information and user input characters. Wherein, the above-mentioned terminal identification is used to indicate the digital resource usage device 500; the collection of specified gesture information requires the digital resource usage device 500 to have a tactile function, and the registered user can use the tactile function of the digital resource usage device 500 to input a specified gesture, so that the first feature The collection module 502 collects specified gesture information; the above-mentioned user biometric information requires that the digital resource usage device 500 has a biometric reading function, and the user biometrics can be, for example, face, pupil, or fingerprint. It should be noted that the user characteristic information collected by the first characteristic collection module 502 in the embodiment of the present invention is consistent with the user characteristic information provided by the registered user when obtaining the authorization of the digital resource protection device. In practical applications, since the user feature information collected by the first feature collection module 502 may not be exactly the same each time, for example, for user-specified gestures and user biometric information, slight changes in sampling points will make the final collected user feature information Information changes, for example, when the user obtains the authorization information, the user characteristic information re-input may be F', therefore, the implementation of the present invention also provides an error-tolerant error correction mechanism, by setting ECC, so that one of the user characteristic information The value of an item of information or the value of a combination of multiple pieces of information is regarded as the same value within a predetermined variation range, that is, when the user characteristic information collected by the first characteristic collection module 502 is considered to be the same user characteristic information within a certain adaptable range. For example, assuming that the error correction code ECC is set, you can make If the user feature information F' collected by the first feature collection module 502 is within the above adaptation range, then by That is, F can be obtained. If the user characteristic information F' collected by the first characteristic collection module 502 is not within the above-mentioned adaptation range, then by Can't get an F.

The first decryption module 503 is used to obtain the secret security index value bound to the above-mentioned registered user according to the user characteristic information input by the above-mentioned registered user collected by the first characteristic collection module 502 and the authorization information obtained by the obtaining module 501;

The second decryption module 504 is configured to use the secret index value obtained by the first decryption module 503 and the encrypted data of the above-mentioned digital resources as input parameters of the above-mentioned digital logic circuit, and perform logic decryption on the above-mentioned encrypted data through the above-mentioned digital logic circuit, to obtain Get the digital resources above.

Further, considering the circulation of the above-mentioned digital resources, the user groups who own and use the above-mentioned digital resources may find changes, such as registered users transferring the purchased digital resources to other users for use. Therefore, the equipment for using digital resources also includes:

The second feature collection module is used to collect user feature information of another user;

An authority exchange module, configured to bind the secret security index value obtained by the first decryption module 503 with the user feature information of another user collected by the second feature collection module, so as to generate the authorization information of the other user;

A sending module, configured to send the authorization information of the other user to the other user, so that the other user obtains the right to use the digital resource.

Further, the authority exchange module is also used for: canceling the above-mentioned registered user, so that the above-mentioned registered user cannot decrypt the above-mentioned digital resource, that is, loses the use right of the above-mentioned digital resource.

It should be noted that the digital resources in the embodiments of the present invention can be digital media (such as text, graphics, images, audio and video and other digital types or a combination of multiple types), computer software, electronic services, equipment used Rights protection terms, etc., are not limited here.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the preset digital logic circuit (such as the digital logic circuit set by the copyright issuer) Logically encrypt the digital resources, because different digital logic circuits can obtain different results after encrypting the same data under the same input parameters. Therefore, even if hackers obtain the secret protection corresponding to the above digital resources Index value, and because it is difficult to obtain the preset digital logic circuit used to encrypt the digital resource, it is impossible to decode and use the above digital resource. Only authorized registered users can use the digital resource to use the encrypted data of the above digital resource The above-mentioned digital resources can only be used after decryption, thereby greatly improving the security of digital resource protection.

The embodiment of the present invention also provides a digital resource protection method. The following describes a digital resource protection method in the embodiment of the present invention with digital resource use equipment as the main body of description. Please refer to FIG. 6 , including:

601. Obtain the authorization information of the registered user;

Wherein, the above-mentioned authorization information is generated by the digital resource protection device by binding the user characteristic information of the above-mentioned registered user with one of the N secret-safety index values.

In the embodiment of the present invention, the above-mentioned digital resource protection device uses any one or more of the above-mentioned N secret protection index values and digital resources as the input parameters of the preset digital logic circuit, and uses the preset digital logic circuit to control the above-mentioned Digital resources are logically encrypted, wherein the above N is greater than 0. After the registered user obtains the authorization of the digital resource protection device, the digital resource protection device sends the generated authorization information of the registered user to the registered user, so that the obtaining module 501 obtains the authorization information of the registered user.

602. Collect the user characteristic information input by the registered user;

The user characteristic information in the embodiment of the present invention includes any one or a combination of any two or more of the following information: terminal identification, designated gesture information, user biometric information and user input characters. Among them, the above-mentioned terminal identification is used to indicate the digital resource use device; the collection of specified gesture information requires the digital resource use device to have a tactile function, and the registered user can use the tactile function of the digital resource use device to input the specified gesture, so that the digital resource use device collects the specified Gesture information; the above-mentioned user biometric information requires that the digital resource usage device has a biometric reading function, and the user biometrics can be, for example, a face, pupil, or fingerprint. It should be noted that the user characteristic information collected by the digital resource utilization device in the embodiment of the present invention is consistent with the user characteristic information provided by the registered user when obtaining the authorization of the digital resource protection device. In practical applications, due to the fact that the user feature information collected by digital resource usage devices may not be exactly the same each time, for example, for user-specified gestures and user biometric information, slight changes in sampling points will cause changes in the final collected user feature information. Changes, for example, when the user obtains the authorization information, the user characteristic information re-input may be F'. Therefore, the implementation of the present invention also provides an error-tolerant error correction mechanism. By setting ECC, one item of user characteristic information The value of the value or the value of a combination of multiple pieces of information is regarded as the same value within a predetermined range of variation, that is, when the user characteristic information collected by the digital resource utilization device is within a certain range of adaptation, it is considered to be the same user characteristic information. For example, assuming that the error correction code ECC is set, you can make If the user characteristic information F' collected by the digital resource usage equipment is within the above-mentioned adaptation range, then by F can be obtained. If the user characteristic information F' collected by the digital resource usage equipment is not within the above-mentioned adaptation range, then by Can't get an F.

603. Obtain a security index value bound to the registered user according to the collected user characteristic information input by the registered user and the authorization information.

604. Using the secret index value bound to the registered user and the encrypted data of the digital resource as input parameters of the digital logic circuit, logically decrypt the encrypted data through the digital logic circuit to obtain the digital resource.

Further, considering the circulation of the above-mentioned digital resources, the user groups who own and use the above-mentioned digital resources may find changes, such as registered users transferring the purchased digital resources to other users. Therefore, the protection of digital resources in the embodiment of the present invention The method further includes: collecting user characteristic information of another user; binding the secret security index value obtained in step 603 with the collected user characteristic information of the other user to generate the authorization information of the other user; The authorization information of the other user is sent to the other user, so that the other user obtains the right to use the digital resource. Further, after generating the authorization information of the other user, the digital resource usage device can also cancel the registered user, so that the registered user cannot decrypt the digital resource, that is, loses the right to use the digital resource.

It should be noted that the digital resources in the embodiments of the present invention can be digital media (such as text, graphics, images, audio and video and other digital types or a combination of multiple types), computer software, electronic services, equipment used Rights protection terms, etc., are not limited here.

It should be noted that the digital resource protection method in the embodiment of the present invention can be applied to the digital resource utilization device in the above-mentioned device embodiment, and can be used to realize all the technical solutions in the above-mentioned device embodiment. The functions of each functional module can be specifically realized by referring to the method in this method embodiment, and the specific implementation process can refer to the relevant description in this method embodiment, and will not be repeated here.

It can be seen from the above that in the embodiment of the present invention, the security index value corresponding to the digital resource that needs to be kept secret is used as the input parameter of the digital logic circuit, and the preset digital logic circuit (such as the digital logic circuit set by the copyright issuer) Logically encrypt the digital resources, because different digital logic circuits can obtain different results after encrypting the same data under the same input parameters. Therefore, even if hackers obtain the secret protection corresponding to the above digital resources Index value, and because it is difficult to obtain the preset digital logic circuit used to encrypt the digital resource, it is impossible to decode and use the above digital resource. Only authorized registered users can use the digital resource to use the encrypted data of the above digital resource The above-mentioned digital resources can only be used after decryption, thereby greatly improving the security of digital resource protection.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

A digital resource protection method and related devices provided by the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principles and embodiments of the present invention. The descriptions of the above embodiments are only used to help understand the present invention. The method of the invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the embodiment of the present invention, there will be changes in the specific implementation and scope of application. In summary, the content of this specification should not be understood To limit the present invention.

Claims (22)

1. a digital resource protection equipment, is characterized in that, comprising:

For the configuration module of N number of secret guarantor's index value corresponding to the digital resource configured with need to encrypt, wherein, described N is greater than 0; The number of described secret guarantor's index value is more than or equal to the circulation of described digital resource;

For by any one in described N number of secret guarantor's index value or multiple, with the input parameter of described digital resource as the DLC (digital logic circuit) preset, by described default DLC (digital logic circuit), described digital resource is carried out to the Digital Logic control module of logical encrypt;

Described digital resource protection equipment, also comprises:

Collection apparatus module, for gathering the user's characteristic information of registered user;

Authorization module, binds for secret guarantor's index value in the user's characteristic information of described registered user that described collection apparatus module obtained and described N number of secret guarantor's index value, to generate the authorization message of described registered user;

Sending module, for the authorization message of described registered user is sent to described registered user, so that described registered user is by input user's characteristic information, authorization message in conjunction with described registered user obtains the secret guarantor's index value bound with described registered user, utilizes this secret guarantor's index value and described DLC (digital logic circuit) to decipher described digital resource.

2. digital resource protection equipment according to claim 1, is characterized in that,

There is first secret guarantor's index value that at least one is configured with the first response vector value in described N number of secret guarantor's index value, described first response vector value uses the number of times of described digital resource for the registered user controlling to bind with described first secret guarantor's index value.

3. digital resource protection equipment according to claim 1, is characterized in that,

There is second secret guarantor's index value that at least one is configured with the second response vector value in described N number of secret guarantor's index value, described second response vector value uses the time period of described digital resource for limiting the registered user bound with described second secret guarantor's index value.

4. digital resource protection equipment according to claim 1, is characterized in that,

There is at least one third secretary being configured with the 3rd response vector value in described N number of secret guarantor's index value and protect index value, described 3rd response vector value to be protected the registered user that index value binds use the electronic equipment that should use during described digital resource for being limited with described third secretary.

5. digital resource protection equipment according to claim 1, is characterized in that,

There is the 4th secret guarantor's index value that at least one is configured with the 4th response vector value in described N number of secret guarantor's index value, described 4th response vector value uses the physical location that should be in during described digital resource for limiting the registered user bound with described 4th secret guarantor's index value.

6. the digital resource protection equipment according to any one of claim 1 to 5, is characterized in that,

Described user's characteristic information comprises the combined information of any one in following information or any more than two:

Terminal iidentification, specifies gesture information, user biological characteristic information and user inputs character.

7. digital resource protection equipment according to claim 6, is characterized in that,

The value of an information in described user's characteristic information or the value of multinomial information combination are considered as same value in predetermined variation scope.

8. the digital resource protection equipment according to any one of claim 4 to 5, is characterized in that,

Described digital resource protection equipment, also comprises:

Cancellation module, for nullifying the registered user authorized, the registered user authorized described in making cannot decipher described digital resource.

9. digital resource uses an equipment, it is characterized in that, comprising:

Acquisition module, for obtaining the authorization message of registered user, wherein, described authorization message is that secret guarantor's index value in the user's characteristic information of described registered user and N number of secret guarantor's index value is carried out binding and generates by digital resource protection equipment, described digital resource protection equipment is by any one in described N number of secret guarantor's index value or multiple, with the input parameter of digital resource as the DLC (digital logic circuit) preset, by the DLC (digital logic circuit) preset, logical encrypt is carried out to described digital resource; The number of described secret guarantor's index value is more than or equal to the circulation of described digital resource;

Fisrt feature acquisition module, for gathering the user's characteristic information of described registered user input;

First deciphering module, the authorization message that user's characteristic information and described acquisition module for the described registered user's input according to the collection of described fisrt feature acquisition module get obtains the secret guarantor's index value bound with described registered user;

Second deciphering module, for the enciphered data of secret guarantor's index value that described first deciphering module is obtained and described digital resource as the input parameter of described DLC (digital logic circuit), by described DLC (digital logic circuit), logic deciphering is carried out to described enciphered data, to obtain described digital resource.

10. digital resource according to claim 9 uses equipment, it is characterized in that,

Described digital resource uses equipment, also comprises:

Second feature acquisition module, for gathering the user's characteristic information of another user;

Authority Switching Module, the user's characteristic information for another user of secret guarantor's index value of being obtained by described first deciphering module and the collection of described second feature acquisition module is bound, to generate the authorization message of another user described;

Sending module, for the authorization message of another user described being sent to another user described, obtains to make another user described the authority using described digital resource.

11. digital resources according to claim 10 use equipment, it is characterized in that,

Described authority Switching Module also for: nullify described registered user, make described registered user cannot decipher described digital resource.

12. 1 kinds of digital resource protection method, is characterized in that, comprising:

Configure the N number of secret guarantor index value corresponding with the digital resource needing to encrypt, wherein, described N is greater than 0; The number of described secret guarantor's index value is more than or equal to the circulation of described digital resource;

By any one in described N number of secret guarantor's index value or multiple, and described digital resource is as the input parameter of the DLC (digital logic circuit) preset, and carries out logical encrypt by described default DLC (digital logic circuit) to described digital resource;

Described by DLC (digital logic circuit) described digital resource is encrypted after, also comprise:

Gather the user's characteristic information of registered user;

Secret guarantor's index value in the user's characteristic information of described registered user and described N number of secret guarantor's index value is bound, to generate the authorization message of described registered user;

The authorization message of described registered user is sent to described registered user, so that described registered user obtains the secret guarantor's index value bound with described registered user according to the user's characteristic information that the authorization message of described registered user and described registered user input, this secret guarantor's index value and described DLC (digital logic circuit) is utilized to decipher described digital resource.

13. methods according to claim 12, is characterized in that,

There is first secret guarantor's index value that at least one is configured with the first response vector value in described N number of secret guarantor's index value, described first response vector value uses the number of times of described digital resource for limiting the registered user bound with described first secret guarantor's index value.

14. methods according to claim 12, is characterized in that,

There is second secret guarantor's index value that at least one is configured with the second response vector value in described N number of secret guarantor's index value, described second response vector value uses the time period of described digital resource for limiting the registered user bound with described second secret guarantor's index value.

15. methods according to claim 12, is characterized in that,

There is at least one third secretary being configured with the 3rd response vector value in described N number of secret guarantor's index value and protect index value, described 3rd response vector value to be protected the registered user that index value binds use the electronic equipment that should use during described digital resource for being limited with described third secretary.

16. methods according to claim 13, is characterized in that,

There is the 4th secret guarantor's index value that at least one is configured with the 4th response vector value in described N number of secret guarantor's index value, described 4th response vector value uses the physical location that should be in during described digital resource for limiting the registered user bound with described 4th secret guarantor's index value.

17., according to claim 12 to the method described in 16 any one, is characterized in that, described user's characteristic information comprises the combined information of any one in following information or any more than two:

Terminal iidentification, specifies gesture information, user biological characteristic information and user inputs character.

18. methods according to claim 17, is characterized in that,

The value of an information in described user's characteristic information or the value of multinomial information combination are considered as same value in predetermined variation scope.

19., according to claim 12 to the method described in 16 any one, is characterized in that,

Described method also comprises: nullify the registered user authorized, the registered user authorized described in making cannot decipher described digital resource.

20. 1 kinds of digital resource protection method, is characterized in that, comprising:

Obtain the authorization message of registered user, wherein, described authorization message is that secret guarantor's index value in the user's characteristic information of described registered user and N number of secret guarantor's index value is carried out binding and generates by digital resource protection equipment, described digital resource protection equipment is by any one in described N number of secret guarantor's index value or multiple, with the input parameter of digital resource as the DLC (digital logic circuit) preset, by the DLC (digital logic circuit) preset, logical encrypt is carried out to described digital resource; The number of described secret guarantor's index value is more than or equal to the circulation of described digital resource;

Gather the user's characteristic information of described registered user input;

The user's characteristic information inputted according to the described registered user of described collection and described authorization message obtain the secret guarantor's index value bound with described registered user;

The secret guarantor's index value described and described registered user bound and the enciphered data of described digital resource, as the input parameter of described DLC (digital logic circuit), carry out logic deciphering by described DLC (digital logic circuit) to described enciphered data, to obtain described digital resource.

21. methods according to claim 20, is characterized in that,

Described method also comprises:

Gather the user's characteristic information of another user;

The user's characteristic information of the secret guarantor's index value described and described registered user bound and another user of described collection is bound, to generate the authorization message of another user described;

The authorization message of another user described is sent to another user described, obtain to make another user described the authority using described digital resource.

22. methods according to claim 21, is characterized in that,

The user's characteristic information of another user of described secret guarantor's index value of described and described registered user being bound and described collection is bound, and comprises afterwards:

Nullify described registered user, make described registered user cannot decipher described digital resource.